:doc:`CloudWatchLogs <../../logs>` / Client / filter_log_events

*****************
filter_log_events
*****************



.. py:method:: CloudWatchLogs.Client.filter_log_events(**kwargs)

  

  Lists log events from the specified log group. You can list all the log events or filter the results using one or more of the following:

   

  
  * A filter pattern
   
  * A time range
   
  * The log stream name, or a log stream name prefix that matches multiple log streams
  

   

  You must have the ``logs:FilterLogEvents`` permission to perform this operation.

   

  You can specify the log group to search by using either ``logGroupIdentifier`` or ``logGroupName``. You must include one of these two parameters, but you can't include both.

   

  ``FilterLogEvents`` is a paginated operation. Each page returned can contain up to 1 MB of log events or up to 10,000 log events. A returned page might only be partially full, or even empty. For example, if the result of a query would return 15,000 log events, the first page isn't guaranteed to have 10,000 log events even if they all fit into 1 MB.

   

  Partially full or empty pages don't necessarily mean that pagination is finished. If the results include a ``nextToken``, there might be more log events available. You can return these additional log events by providing the nextToken in a subsequent ``FilterLogEvents`` operation. If the results don't include a ``nextToken``, then pagination is finished.

   

  Specifying the ``limit`` parameter only guarantees that a single page doesn't return more log events than the specified limit, but it might return fewer events than the limit. This is the expected API behavior.

   

  The returned log events are sorted by event timestamp, the timestamp when the event was ingested by CloudWatch Logs, and the ID of the ``PutLogEvents`` request.

   

  If you are using CloudWatch cross-account observability, you can use this operation in a monitoring account and view data from the linked source accounts. For more information, see `CloudWatch cross-account observability <https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Unified-Cross-Account.html>`__.

   

  .. note::

    

    If you are using `log transformation <https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CloudWatch-Logs-Transformation.html>`__, the ``FilterLogEvents`` operation returns only the original versions of log events, before they were transformed. To view the transformed versions, you must use a `CloudWatch Logs query. <https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html>`__

    

  

  See also: `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/logs-2014-03-28/FilterLogEvents>`_  


  **Request Syntax**
  ::

    response = client.filter_log_events(
        logGroupName='string',
        logGroupIdentifier='string',
        logStreamNames=[
            'string',
        ],
        logStreamNamePrefix='string',
        startTime=123,
        endTime=123,
        filterPattern='string',
        nextToken='string',
        limit=123,
        interleaved=True|False,
        unmask=True|False
    )
    
  :type logGroupName: string
  :param logGroupName: 

    The name of the log group to search.

     

    .. note::

      

      You must include either ``logGroupIdentifier`` or ``logGroupName``, but not both.

      

    

  
  :type logGroupIdentifier: string
  :param logGroupIdentifier: 

    Specify either the name or ARN of the log group to view log events from. If the log group is in a source account and you are using a monitoring account, you must use the log group ARN.

     

    .. note::

      

      You must include either ``logGroupIdentifier`` or ``logGroupName``, but not both.

      

    

  
  :type logStreamNames: list
  :param logStreamNames: 

    Filters the results to only logs from the log streams in this list.

     

    If you specify a value for both ``logStreamNames`` and ``logStreamNamePrefix``, the action returns an ``InvalidParameterException`` error.

    

  
    - *(string) --* 

    

  :type logStreamNamePrefix: string
  :param logStreamNamePrefix: 

    Filters the results to include only events from log streams that have names starting with this prefix.

     

    If you specify a value for both ``logStreamNamePrefix`` and ``logStreamNames``, the action returns an ``InvalidParameterException`` error.

    

  
  :type startTime: integer
  :param startTime: 

    The start of the time range, expressed as the number of milliseconds after ``Jan 1, 1970 00:00:00 UTC``. Events with a timestamp before this time are not returned.

    

  
  :type endTime: integer
  :param endTime: 

    The end of the time range, expressed as the number of milliseconds after ``Jan 1, 1970 00:00:00 UTC``. Events with a timestamp later than this time are not returned.

    

  
  :type filterPattern: string
  :param filterPattern: 

    The filter pattern to use. For more information, see `Filter and Pattern Syntax <https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html>`__.

     

    If not provided, all the events are matched.

    

  
  :type nextToken: string
  :param nextToken: 

    The token for the next set of events to return. (You received this token from a previous call.)

    

  
  :type limit: integer
  :param limit: 

    The maximum number of events to return. The default is 10,000 events.

    

  
  :type interleaved: boolean
  :param interleaved: 

    If the value is true, the operation attempts to provide responses that contain events from multiple log streams within the log group, interleaved in a single response. If the value is false, all the matched log events in the first log stream are searched first, then those in the next log stream, and so on.

     

    **Important** As of June 17, 2019, this parameter is ignored and the value is assumed to be true. The response from this operation always interleaves events from multiple log streams within a log group.

    

  
  :type unmask: boolean
  :param unmask: 

    Specify ``true`` to display the log event fields with all sensitive data unmasked and visible. The default is ``false``.

     

    To use this operation with this parameter, you must be signed into an account with the ``logs:Unmask`` permission.

    

  
  
  :rtype: dict
  :returns: 
    
    **Response Syntax**

    
    ::

      {
          'events': [
              {
                  'logStreamName': 'string',
                  'timestamp': 123,
                  'message': 'string',
                  'ingestionTime': 123,
                  'eventId': 'string'
              },
          ],
          'searchedLogStreams': [
              {
                  'logStreamName': 'string',
                  'searchedCompletely': True|False
              },
          ],
          'nextToken': 'string'
      }
      
    **Response Structure**

    

    - *(dict) --* 
      

      - **events** *(list) --* 

        The matched events.

        
        

        - *(dict) --* 

          Represents a matched event.

          
          

          - **logStreamName** *(string) --* 

            The name of the log stream to which this event belongs.

            
          

          - **timestamp** *(integer) --* 

            The time the event occurred, expressed as the number of milliseconds after ``Jan 1, 1970 00:00:00 UTC``.

            
          

          - **message** *(string) --* 

            The data contained in the log event.

            
          

          - **ingestionTime** *(integer) --* 

            The time the event was ingested, expressed as the number of milliseconds after ``Jan 1, 1970 00:00:00 UTC``.

            
          

          - **eventId** *(string) --* 

            The ID of the event.

            
      
    
      

      - **searchedLogStreams** *(list) --* 

        **Important** As of May 15, 2020, this parameter is no longer supported. This parameter returns an empty list.

         

        Indicates which log streams have been searched and whether each has been searched completely.

        
        

        - *(dict) --* 

          Represents the search status of a log stream.

          
          

          - **logStreamName** *(string) --* 

            The name of the log stream.

            
          

          - **searchedCompletely** *(boolean) --* 

            Indicates whether all the events in this log stream were searched.

            
      
    
      

      - **nextToken** *(string) --* 

        The token to use when requesting the next set of items. The token expires after 24 hours.

         

        If the results don't include a ``nextToken``, then pagination is finished.

        
  
  **Exceptions**
  
  *   :py:class:`CloudWatchLogs.Client.exceptions.InvalidParameterException`

  
  *   :py:class:`CloudWatchLogs.Client.exceptions.ResourceNotFoundException`

  
  *   :py:class:`CloudWatchLogs.Client.exceptions.ServiceUnavailableException`

  